Hacker Deploys Hermes AI Agent for Autonomous Cyberattacks on 460+ Targets

Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks

Palo Alto Networks' Unit 42 says a Chinese-speaking threat actor used DeepSeek through the open-source Hermes Agent framework to launch attacks autonomously. After an initial Telegram instruction, the agent found internet-facing systems and selected public exploits. The researchers recovered no further operator input in the session. The operator, tracked through the aliases knaithe and KnYuan, launched exploitation attempts against more than 460 targets using autonomous and conventional workflows. Unit 42 described seven exploit tracks. They span eight Common Vulnerabilities and Exposures (CVE) identifiers because the n8n chain combines two vulnerabilities. The DeepSeek-led attacks against Langflow and n8n failed because the exposed systems did not meet the exploits' configuration requirements. In separate manual operations, Unit 42 reported data exfiltration from three organizations through the NetScaler memory-overread flaw CVE-2026-3055 and command execution on 11 Marimo instances through CVE-2026-39987. Yet it later says it could confirm only three successfully exploited targets across the entire operation. The report does not reconcile the two statements. The Hacker News has contacted Palo Alto Networks for clarification and will update the story with any response. The agent checked versions, downloaded exploits, abandoned an unproductive path, and chose another vulnerability based on severity, deployment scale, and apparent exploitability. Organizations should patch exposed Langflow, n8n and Marimo systems, along with customer-managed NetScaler ADC or Gateway appliances configured as Security Assertion Markup Language (SAML) identity providers. They should also remove unnecessary public access to workflow and notebook interfaces. Hermes Agent exposed the operation by starting python3 -m http.server 8888 from /home/worker. The unintended HTTP server made the actor's model configurations, application programming interface (API) keys, exploit scripts, target lists, shell history, and autonomous-session logs accessible, according to the company's report. DeepSeek was the primary reasoning model inside Hermes Agent, which supplied terminal access, reusable skills and unattended execution. Unit 42 found limited use of Claude Code and Qwen Code. It also found signs of Codex use in exploit-development directories, but could not verify actual use because the chat logs were not preserved. The framework's own documentation confirms that it can operate through Telegram, run commands, and schedule unattended tasks. In a recovered May 2026 session, DeepSeek downloaded a public exploit for the Langflow code-injection flaw CVE-2026-33017, enumerated 84 instances through FOFA, and found one target running version 1.3.4. Langflow is an artificial intelligence (AI) agent and workflow builder. The attack stopped because the system had neither auto_login enabled nor a usable public flow identifier. The agent then surveyed 10 product families, searched GitHub for recent proof-of-concept repositories and selected n8n, the workflow automation platform. It obtained a chain combining the unauthenticated file-access flaw CVE-2026-21858 with the expression-injection issue CVE-2025-68613. FOFA returned 25,209 n8n systems in China during the session. DeepSeek sampled about 100, probed roughly 40 and identified three running vulnerable versions. One target exposed three form endpoints, but all required authentication. More than 50 additional targets also lacked a usable public form, so no n8n system was compromised. Langflow fixed CVE-2026-33017 in version 1.9.0. n8n fixed CVE-2026-21858 in version 1.121.0. It fixed CVE-2025-68613 in versions 1.120.4, 1.121.1, and 1.122.0. Version 1.121.1 is therefore the earliest release that addresses both flaws used in the attempted chain. Marimo fixed CVE-2026-39987 in version 0.23.0. Citrix says CVE-2026-3055 affects customer-managed NetScaler ADC and Gateway appliances configured as SAML identity providers. Administrators can check the appliance configuration for add authentication samlIdPProfile .* and install the fixed builds listed in the company's security bulletin. Unit 42 assesses the operator to be based in Zhuhai, China. Public material is consistent with, but does not independently verify, that assessment: the GitHub profile displays the name "KnYuan Knaithe," while an older blog under the same handle describes its author as a binary security researcher in Zhuhai. Those profiles do not establish the operator's legal identity or any state connection.

Hacker uses DeepSeek AI to autonomously attack vulnerable servers

A Chinese-speaking threat actor is using the DeepSeek AI model and the open-source Hermes Agent to conduct autonomous cyberattacks on exposed servers with limited human involvement. The activity was discovered by Palo Alto Networks' Unit 42 researchers after Hermes accidentally created a web server from its home directory, exposing the attacker's environment, including API keys, exploit scripts, target lists, shell history, and AI attack logs. Unit 42 attributed the activity to a China-based threat actor operating under the aliases "knaithe" and "KnYuan," who calls themself a "binary security researcher." While the autonomous attacks observed by Unit 42 did not successfully compromise the targeted servers, the researchers say the campaign illustrates an offensive AI workflow capable of discovering, evaluating, and attacking vulnerable systems. "While the observed campaign had limited impacts, the workflow confirms a functional, end-to-end autonomous offensive capability," Unit 42 said. DeepSeek used for autonomous attacks The threat actor used DeepSeek as the reasoning engine behind Hermes Agent, an open-source AI framework capable of interacting with operating system terminals, running commands, and connecting to the internet. The agent supports a "Yolo" mode that allows it to operate and execute commands, even risky ones, without first requesting permission from its operator. Hermes was configured to accept instructions from a Telegram channel, use custom offensive-security skills, and integrate with the FOFA internet asset search engine. Unit 42 recovered a May 2026 session in which the operator appears to have provided only an initial task, after which the agent conducted the remaining activity autonomously without human feedback. The agent first targeted internet-exposed Langflow servers vulnerable to CVE-2026-33017, downloading a public proof-of-concept exploit, identifying 84 exposed instances through FOFA, and scanning them for vulnerable configurations. After determining that the available targets could not be exploited, the agent searched for other potential vulnerabilities to scan for vulnerable devices. DeepSeek then analyzed multiple public exploit repositories before selecting the n8n workflow automation platform to target, which had more than 647,000 exposed instances identified through FOFA. The agent downloaded an exploit that chained CVE-2026-21858 and CVE-2025-68613, identified servers running vulnerable versions, and checked them for unauthenticated file-upload forms required to complete the attack. However, the discovered forms required authentication, and Unit 42 says the autonomous attempts failed to compromise any targets. Unit 42 says the campaign is significant because the agent independently researched vulnerabilities, determined which targets were the best option, downloaded exploit code, and then attempted to exploit found targets in minutes what would normally take many hours. "This autonomous process of target identification, sampling and narrowing of scope is notable because the system executed hundreds of hours of manual targeting analysis in mere minutes, while also managing its own compute resources," explained Palo Alto. While the AI agent was used extensively, the threat actor also conducted manual attacks against more than 460 systems using vulnerabilities affecting Citrix NetScaler, Apache Tomcat, Marimo Notebook, Windows IKE VPN, and other products. Unit 42 confirmed three successful compromises targeting the Citrix NetScaler vulnerability CVE-2026-3055, which the actor used to extract memory and search for authentication cookies that could be used to hijack sessions. The actor had also configured other AI coding platforms, including Qwen, GLM, Kimi, MiniMax, Claude Code, and OpenAI's Codex, but Unit 42 found that they were not used often. Hermes used in previous cyberattack The exposed AI campaign comes after another recently disclosed incident in which poorly secured Hermes infrastructure exposed details about an alleged cyberattack against Thailand's Ministry of Finance. Last week, BleepingComputer reported that Hunt.io and security researcher Bob Diachenko discovered open web directories containing exploit tools, web shells, credentials, compiled payloads, and Hermes activity logs. Those logs showed Hermes running in unattended "YOLO" mode to automate post-exploitation activity, including searching for privilege-escalation opportunities, enumerating services, inspecting containers, traversing filesystems, and cataloging documents stored on Ministry of Finance systems. However, the earlier incident did not show Hermes independently choosing the target or determining how to compromise it. A human operator supplied the target, objectives, and attack tools, while Hermes automated routine activity after access had apparently already been obtained.

Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry

Someone installed a popular AI assistant on a rented server, switched off the setting that makes it ask permission before running risky commands, and pointed it at Thailand's Ministry of Finance, which runs the country's treasury and tax collection. The agent then worked through the ministry's network on its own, checking hosts for ways to gain root access, hunting through file systems, and crawling a folder of staff personnel records going back to 2012. The operator left the agent's own logs sitting on a web server with directory listing switched on, where threat intelligence firm Hunt.io and researcher Bob Diachenko found them, along with 585 files and 470 MB of attack tooling. The tool is Hermes, an open-source assistant from Nous Research that people install to manage their mail, run chores, and take instructions over Telegram or Slack. It is not a hacking tool, and nothing here is a flaw in it. The mode the operator used, called YOLO, is a documented feature with its own command-line flag. That is what separates this case from the AI-assisted attacks reported so far. When Anthropic disclosed a Chinese group using Claude Code for espionage last November, the attackers had to trick the model into cooperating, and Anthropic banned their accounts once it noticed. Hermes runs on the operator's own machine. No vendor was watching, and there was no account to ban. The operator was already inside before the agent started. Hunt.io recovered a hidden web shell planted on a ministry web server, scripts written against named internal Hadoop systems, and stolen mailbox passwords hardcoded into a mail-testing script. Nothing in the recovered files shows data leaving the network, and how the operator first got in is unknown. Thailand's national CERT and cybersecurity agency were notified on July 15; neither had published anything when The Hacker News checked on July 24. For everyone else, the useful detail is what the operator's scripts were built to exploit: a Hadoop database service that ships accepting any password by default. The human did the parts that require knowing the target. Hunt.io's writeup shows a password list built from the ministry's own department abbreviations rather than a dictionary, and shellcode carrying hardcoded paths into the ministry intranet. The agent did the repetitive part: run a scan, read the output, decide what to check next, run another. Nothing in the recovered material shows it finding a new vulnerability or choosing the target. None of the commands were exotic. LinPEAS, a standard script that hunts for privilege escalation paths on Linux. A search for files carrying elevated permissions. A directory crawl. A person would type the same things. What changed is that nobody had to approve each one. Hermes offers that setting three ways: a --yolo flag at launch, a /yolo command mid-session, or a HERMES_YOLO_MODE=1 environment variable. The project's configuration guide says to "only use this in trusted, sandboxed environments." One layer survives it: a hardline blocklist that still refuses commands which would wipe the machine the agent is running on. What the operator switched off was the human check, not every safeguard. What the agent did Five files named call_00_*.txt hold the agent's turns: kernel vulnerability scanning against a ministry host, a second LinPEAS run, a sweep for elevated-permission binaries, a filesystem listing, and a recursive crawl of the web root belonging to the Office of the Permanent Secretary. That folder held Office documents, performance evaluations, and personnel records dating to 2012. The logs show the agent reading the directory. None of them show the files leaving it. The scan script it was handed was not stock. A customized linpeas.sh checked for four 2026 Linux kernel flaws across three families: Copy Fail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 and CVE-2026-43500), and DirtyClone (CVE-2026-43503). Each hands a local user root where its prerequisites hold, which for Dirty Frag and DirtyClone means CAP_NET_ADMIN. All were weeks old when the operator staged them, and nothing recovered names a ministry kernel version or shows that any of the four ran. The operator's own SSH session into the staging server came from 103.97.0[.]57 in Hong Kong. The agent's web interface password contains the Chinese word Leishen, thunder god, and a key for FOFA, a Chinese asset-search service, sits alongside it. The same server previously hosted a ShadowPad controller and now runs a VShell command-and-control listener. Hunt.io assesses with low-to-medium confidence that the operator is Chinese-speaking or fluent in the language, and names no group. The firm and Diachenko remain the only public source for the ministry-specific findings. The route into Hadoop Most of the custom code went on the ministry's Hadoop cluster, where it stores and queries large volumes of data. A script called hive_rce_py2.py connects to HiveServer2, the SQL front end to that cluster, on an internal machine at port 10000, and sends a password. Apache's own documentation says the default authentication mode is NONE, which accepts whatever password it is given without checking it. Once connected, the script installs a malicious Java add-on called HiveCmd.jar as a user-defined function, which lets it run operating-system commands through ordinary database queries and read the results back. Cloudera warns that anyone able to install such a function can run arbitrary code as the Hive service account and reach sensitive data. Also staged on the server: a previously undocumented Go implant the operator calls Hades, built for both Windows and Linux in 62 copies. Hunt.io analyzed one of each and found the same codebase; the other 60 were not examined individually. Their hardcoded addresses tie the staging server to a second Hong Kong host, though no recovered artifact shows Hades reaching a ministry machine. Separate scripts tested default credentials against an internal GlassFish console, with neither deployment confirmed, alongside exploit code for three older flaws in polkit, sudo, and IIS 6.0. What to do * Check whether HiveServer2 is running with authentication set to NONE, and restrict who can install user-defined functions. That default is what the operator's script was written to rely on. * Alert when a web server process opens a connection to internal Hadoop ports such as 10000 or 50070. A web server reaching a Hadoop node is worth a look on its own. * Search web roots recursively for PHP files with leading-dot names that imitate system caches. This one sat at /storage/Counter/nine/.journald-cache.php and does not appear in a normal directory listing. * Patch kernels against all four 2026 flaws above, plus sudo to 1.9.5p2 or later, polkit for CVE-2021-4034, and any remaining IIS 6.0 WebDAV. The agent leaves its own trail. Hermes's web panel returns a HermesWebUI server header, and a search on that string returned roughly 5,900 scan events over a month, as of Hunt.io's July 23 report, counting sightings rather than distinct machines. The better hook is where the agent writes its results: a consistent /hermes-results/ folder with predictable filenames, which turned up 575 hits in Hunt.io's index of exposed directories the same day, each one a host and filename pair. No safety control exposed this operator. A directory listing did. The endpoint sees the same shell commands and the same tools either way. Nothing in an ordinary command line announces that nobody is at the keyboard.

Hermes AI agent used to automate attack on Thai Finance Ministry

A threat actor used the open-source Hermes AI agent in unattended "YOLO" mode to automate post-exploitation activity during an alleged breach of Thailand's Ministry of Finance. The activity was uncovered by threat intelligence company Hunt.io and security researcher Bob Diachenko after they discovered several exposed web directories containing hundreds of files associated with the operation. Hunt.io says session files, deployed web shells, and evidence of access to internal systems indicate that the attackers compromised multiple systems within the ministry's network. However, the Ministry of Finance has not confirmed that its systems were breached, and some of the recovered artifacts only show that particular systems were targeted rather than successfully compromised. BleepingComputer contacted Thailand's Ministry of Finance and ThaiCERT to confirm the reported attack and will update this story if we receive a response. Attack infrastructure exposed online Between July 9 and July 13, Hunt.io discovered three simultaneously exposed directories on a server hosted in Hong Kong. The directories contained 585 files totaling approximately 470 MB, including exploit code, web shells, HTTP tunneling tools, custom scripts, stolen credentials, compiled payloads, and logs generated by the Hermes AI agent. The recovered files referenced Ministry of Finance systems by name, hostname, and internal IP address, and included scripts targeting internal services. Some scripts targeted the ministry's Hadoop infrastructure, Apache Ambari management platform, GlassFish administrative console, and an administrative web panel. Other scripts tested authentication against ministry mail servers using hardcoded email addresses and passwords. Hunt.io also found a PHP web shell that it says had been deployed on a Ministry of Finance web server. The researchers linked the initial server to additional attacker-controlled infrastructure by shared TLS certificates used during the same time period. "In addition to the common name, all these certificates share a JA4X fingerprint, a hash derived from the structure of the certificate itself rather than its contents," explained Hunt's report. "Querying that hash alongside the www common name in HuntSQL returned two additional, related hosts: 118.107.222[.]232 (The Gigabit, Malaysia) and 202.181.27[.]115 (Converged Communications Limited, Hong Kong)." One of those servers was later linked to the operation through a command-and-control address embedded in a recovered implant. The directories also contained Windows and Linux builds of a previously undocumented Go-based implant that the operator called Hades. However, the more interesting discovery was a collection of logs showing that the attackers used an AI agent, Hermes, to automate parts of the cyberattack against the ministry. Hermes operating in YOLO mode Hermes is an open-source AI agent released in February 2026 that runs as a persistent service and can remember information between different task sessions. The AI agent can interact with tools and execute commands while working on tasks provided by the operator. The software includes a setting known as YOLO mode, which removes prompts that would require a person to approve dangerous commands. The researchers were able to recover environment information and Hermes output logs from the exposed directories that showed the operator had enabled this unattended mode. This allowed the agent to execute commands and continue analyzing systems without waiting for human approval at each step. Five recovered Hermes call logs show the agent was used to find a way to elevate privileges, scan for kernel vulnerabilities, enumerate services, search for SUID and SGID binaries, inspect containers, and traverse file systems. Hermes was also told to use a customized version of the LinPEAS privilege-escalation enumeration script to collect information from a Ministry of Finance host. In another task, the operator instructed Hermes to recursively search a web directory associated with the Office of Permanent Secretary for Finance. The agent cataloged PDF, DOC, and XLS files, including performance assessments and personnel records dating back to 2012. However, Hunt says it found no evidence that these files were exfiltrated. The findings do not indicate that Hermes independently decided to target the ministry. Instead, the exposed logs show an operator supplying the agent with objectives and tooling while YOLO mode allowed it to carry out routine post-exploitation commands without constant supervision. Hunt.io says the recovered artifacts depict an active intrusion in which tools had been staged and access to internal systems was expanding. However, the researchers could not determine how the attackers initially gained access. The company and Diachenko notified ThaiCERT and Thailand's National Cyber Security Agency on July 15. According to the report, both organizations acknowledged receiving the notification that day. This Hermes activity is the latest example of autonomous AI agents being used to conduct cyberattacks. Earlier this month, the JadePuffer ransomware operation used an AI agent to automate an entire intrusion, including reconnaissance, credential theft, lateral movement, privilege escalation, and data encryption. Autonomous agents can also cause real-world breaches, even if unintentional. OpenAI recently disclosed that its models autonomously hacked Hugging Face while undergoing cybersecurity benchmark testing, exploiting zero-day vulnerabilities to escape a sandboxed testing environment and access the internet. It then used stolen credentials and additional vulnerabilities to breach Hugging Face's production systems.